URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets the execution of known Mirai botnet payloads via malicious URLs, indicating a likely compromise of IoT or embedded devices within the network. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate infected assets before they participate in large-scale DDoS attacks or lateral movement.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["45.90.163.37"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["45.90.163.37"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• IoT Device Firmware Updates via HTTP: Many legacy IoT devices (e.g., IP cameras, smart plugs, or older routers) use hardcoded HTTP endpoints for firmware checks or configuration syncs. If a device’s update server IP or domain is temporarily mapped to one of the Mirai-tagged URLs in URLhaus due to a shared hosting provider or CDN edge node, legitimate traffic will trigger the rule.

  • Filter/Exclusion: Exclude source IPs belonging to the IoT/OT subnet (e.g., 10.20.0.0/24) or specific device groups (e.g., “IP-Cameras”, “Smart-Plugs”) from this URL-based detection, relying instead on port-based or protocol-based rules for these assets.

• Legacy Application Health Checks: Older enterprise applications (e.g., custom Java-based monitoring agents or legacy SCADA HMI clients) may use hardcoded HTTP URLs for heartbeat pings or license validation. If the vendor’s license server or health check endpoint is hosted on a domain that has been recently tagged as Mirai in URLhaus (due to a compromised subdomain or shared infrastructure), the application’s routine checks will appear malicious.

  • Filter/Exclusion: Create an exclusion for known internal application service accounts or specific source IPs associated with legacy app servers (e.g., AppServer-Legacy-01, AppServer-Legacy-02) when accessing the specific URL paths used for health checks (e.g., /health, /license/check).

• DNS Caching Proxy or Web Filter Logs: In environments using a central DNS caching proxy or a web filtering appliance (e.g., Squid, pfSense, or Zscaler), the proxy itself may make outbound HTTP requests to validate certificates or fetch configuration files from vendor endpoints. If the vendor’s endpoint is tagged as Mirai, the proxy’s internal traffic will trigger the rule